Avoid persisting Dragon checkout credentials

[cmungall]

Summary

• opt both AI-agent checkout steps out of persisted credentials
• configure Git to authenticate through the gh credential helper
• scope GH_TOKEN to the Claude step instead of writing it to GITHUB_ENV

Why

The checkout credential was previously available through Git configuration and could be captured when an agent inspected .git/config. This avoids that accidental exposure path while preserving intelligent gh usage and authenticated git push.

Security boundary

The agent still receives PAT_FOR_PR as GH_TOKEN and as the Claude action github_token input, so it retains the requested GitHub capabilities. This change prevents persistence-based accidental disclosure; it does not sandbox an agent with arbitrary shell access.

Validation

• yq eval '.' .github/workflows/ai-agent.yml
• yamllint -d relaxed .github/workflows/ai-agent.yml (existing line-length warnings only)
• actionlint .github/workflows/ai-agent.yml
• git diff --check